1. Technical Field
This invention relates to an apparatus and method for detecting a malfunction of a processing unit abnormality-monitoring circuit.
2. Discussion
Conventionally, an abnormality-monitoring circuit, often referred to as a watchdog-timer circuit, is disposed in an electronic control unit to detect abnormal operation of a control unit microprocessor due to infinite looping of a program therein.
Such an abnormality-monitoring circuit outputs an actuating pulse signal, or "watchdog pulse," to the processor at a fixed-time interval during processor program execution, and clocks an output interval of this actuating pulse signal. When the clocked time reaches a time established to be longer than the fixed-time interval, the abnormality-monitoring circuit outputs a reset signal to reboot the microprocessor.
However, such an abnormality-monitoring circuit can not detect its own malfunction. Therefore, if the abnormality-monitoring circuit fails, it becomes impossible to prevent abnormal operation of the control unit.
In this regard, an apparatus has been described, for example, in Japanese Patent Application Laid-open No. Hei 6-301574, and in Japanese unexamined patent publication No. Hei 5-14281, for detecting malfunction of an abnormality-monitoring circuit. Namely, before the power to an electronic control unit is switched on and a processing unit begins to run a control program, the processing unit is caused to stop, for a predetermined time, and output an actuating pulse signal to an abnormality-monitoring circuit. When no reset signal is output to the abnormality-monitoring circuit within this predetermined time, the abnormality-monitoring circuit is determined to have malfunctioned.
Meanwhile, a processing unit as described, for example, in Japanese Patent Application Laid-open No. Hei 4-369740, detects a clock time in an abnormality-monitoring circuit at least twice within a generation cycle of an actuating pulse signal, and determines the abnormality-monitoring circuit to be malfunctioning when the present detected value is less than the previous detected value.
However, the related art of the above-described Japanese Patent Application Laid-open No. Hei 6-301574 and in Japanese unexamined patent publication No. Hei 5-14281 inspects the operability of the abnormality-monitoring circuit only upon start-up of the electronic control unit. In a case where malfunction occurs in the abnormality-monitoring circuit during actual processing by the processing unit, it is impossible to detect the malfunction and take appropriate action. As extremely high control safety has come to be demanded in recent years, for example, for a vehicle electronic control unit that controls a vehicle engine, and improvement of control safety reached a ceiling with the above-described related art.
Meanwhile, although the art described in the foregoing Japanese Patent Application Laid-open No. Hei 4-369740 can detect an malfunction in an abnormality-monitoring circuit in real time, whether the abnormality-monitoring circuit has truly clocked a time longer than the generation cycle of the actuating pulse signal cannot be determined. For this reason, malfunction in the abnormality-monitoring circuit cannot reliably be detected. Also, the processing unit must detect a clocked time in the abnormality-monitoring circuit within the generation cycle of the actuating pulse signal at least twice, and the processing load in the processing unit becomes extremely large.